What our analysis found

Picture-in-Picture YouTube - Netflix and more, used by 30,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can inject scripts into pages. It comes from a trusted publisher and was last updated in July 2023.

The entire extension is 990 bytes of JavaScript across two files that do exactly what the listing describes::1-8 injects into the clicked tab, and:3-22 picks the largest ready <video> and toggles requestPictureInPicture() (). There is no, no chrome.storage, no messaging, no tabs.create, no, no remote script, and no obfuscation anywhere in the bundle, and the CRX's own lists only 7 signed files (2 JS, manifest, 4 icons), confirming no code file was dropped during extraction. Signals that appear to corroborate the ML score are all non-code: the 'publisher flagged malicious' flag is circular because this is the publisher's only extension so the leave-one-out set is empty, the 7% permhash malware rate is the base rate for the most generic MV3 permission pair shared by 16,673 versions, and the reviews alleging install prompts or email sign-ups describe behaviour version 1.0.6 has no capability to perform; chrome-stats impact and likelihood is context that points the same way as the code.